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1) There are many reasons to be concerned about the Dominion Voting System and 
the results it produces. It is well documented and demonstrated that it’s heritage 
and software origins are extremely unsettling, given its close relationship to 
Smartmatic and Scytl, facts that have only become clearer with the 4 redacted 
declarations I have now seen from Spider. For this reason, any analysis as to the 
integrity of any election conducted using Dominion should be executed with a 
healthy degree of skepticism, and evidence of abnormal results should be over- 
weighted, if anything. 


Our team has extensive experience as white hat hackers and employ many 
methodologies and tools to trace and certify connections between servers, network 
nodes and other digital properties and probe for network system vulnerabilities. In 
addition to Robtex and Spiderfoot, we also employ such tools as Whois, 
GeolIpLookup, nslookup, host, ipinfo.io, etc. 


From our own company’s work, I can attest to the credibility and veracity of the 
information contained in the four redacted declarations by Spider. Along with 
several others, we have found many of the same connections, relationships and 
vulnerabilities. Further, Clarity Elections and Scytl are integral to the network as 
well as Dominion and Edison Research and they too have multiple vulnerabilities 
and their vulnerabilities represent further vulnerabilities into Dominion. 


For instance, inside the SCYTL System at a point called staging.scytl.us, malware 
called QSnatch is visible. QSnatch represents a deep vulnerability to any election 
system that touches it such as Dominion and Edison Research. QSnatch 
characteristics include: 

e CGI password logger - This installs a fake version of the device admin login 
page, logging successful authentications and passing them to the legitimate 
login page. 

e Credential scraper - This grabs the credentials of any administrator whose 
system loads any information into Scytl or Clarity Elections which includes 
Dominion and Edison Research. This means the credentials of every county 
election official of every state where Dominion manages elections in the U.S. 
are vulnerable to being compromised and utilized by unauthorized persons. 
This includes all counties in Georgia and the counties in Michigan which use 
Dominion. 

e SSH backdoor - This allows the cyber actor to execute arbitrary code ona 
device. 

e Exfiltration - When run, steals a predetermined list of files which includes 
system configuration & log files. Encrypted with hacker's public key and sent 
to their infrastructure over HTTPS. 

¢ Webshell functionality - Allows an attacker remote access 

e Persistence & Mitigation - The malware itself can make it impossible to run 
needed firmware updates. Once infected, a full factory reset must be done on 
the device prior to doing a firmware update to stop vulnerability. 


Here is its location: 


0 O O 0 .¢) 
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Here it can be seen embedded: 


"jid": 14271845, 


"type": "ip", 
"indicator" s °13.32.202«112", 
"Sigk'§. "nots. 


"risk_recommended": "none", 
“manualrisk”: 0, 

"retired": null, 

"stamp added": "2020-08-16 07:19:05", 
“stamp updated": "2020-09-21 18:57:23", 
“stamp seen": "2020-09-15 01:15:00", 
"stamp probed": "2020-09-21 18:57:23", 
"stamp retired": null, 


Source code for Dominion can easily be obtained on the dark web so that an attacker 
knows all the vulnerable points and can plan and plant any malicious code the 
attacker desires. Here is a small sample of what can be seen on Pirates Bay 
TORR: 


“ProductCode","ProductName","ProductVersion","OpSystemCode' 
Type" 

11818, "OpenElect","1.0","189","1422","English","Voting" 
15134,"Hart Voting System Software Files 
(BallotNow)","3.3.12","189","2049", "English", "Voting" 
15134,"Hart Voting System Software Files 
(BallotNow)","3.3.12","366","2049","English", "Voting" 
15542,"Open Elect Release","1.2","51","1422", "English", "Vo’ 
16786, "OpenElect","1.3","51","1422", "English", "Voting" 
17345,"Installed files for D-Suite 4.14-D,WinEDS 3.1.012, \ 
4.0.175", "2016-01-12" ,"786", "2530", "English", "Voting" 
17429,"Democracy Suite Election Event Designer (EED) Insta 
File "4. l4es7 "365", 2000» Eng ish", “Voting™ 
17430,"Democracy Suite ImageCast Central (ICC) Installed 
File","4.14.17","365","2530","English","Voting"™ 
17431,"Democracy Suite Adjudication (ADJ) Installed 

Pi le” Piva leeks oe) eee; CO LIS; yc 


2) The use of an algorithm being used in the vote counting is evident from a number 
of perspectives. First, there is the apparent product of decimal places being used in 
points instead of whole number votes that can be viewed from the NYT times Edison 
data. In the two-time series shown below, note the percentages in Series 357 that 
shows 3 decimal places displayed in the percentage distribution of the 3,616,879 
votes. One might argue that the issue is simply due to the fact only 3 decimal places 
are displayed, and that if 20 or 30 decimal places were displayed, one would see 
whole numbers appear as votes instead of points with decimal places, and therefore 
there is no evidence in this illustration that an allocative algorithm was utilized. The 
problem with this is two-fold. The first is the percentages do not come close to 
100% regardless of rounding. But the difference between the 98.2% displayed and 
100% might be due to Jo Jorgenson. The presence of Jo Jorgenson as a third-party 
candidate is exactly the scenario for which RCV was supposedly concocted and 
contrary to Dr. Rodden assertion that Dominion RCV voting is incapable of 
producing non-integer vote totals, Dominion’s own manual doesn’t agree with him. 
See “Fixed Precision Decimals” in the manual page below: 


Source: Democracy Suite EMS Results Tally & Reporting User Guide 
Version: 5.11-CO::7 May 28, 2019 
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5/28/2019 


Chapter 11 - Ranked Choice Voting 


separately. By leaving it unchecked all results will not be separated per 
precinct. This option is relevant for STV, because calculating surplus 
transfer for each precinct separately will create a higher total surplus 
transfer remainder than when surplus transfer is not separated per precinct. 


Pause After Round: When this option is selected the tabulation session 
will pause the tabulation session after each round. If it is not selected the 
session will continue until the end or until a manual tie break is required. 


Fixed Precision Decimals: This option allows you to specify how many 
decimals the votes should be represented during calculation, this is relevant 
only for the STV and Points IRV methods where votes and points are 
expressed as fractional values. 


+ Skip Overvoted Rankings: This option allows the algorithm to skip over- 
voted rankings and proceed to the next ranking. No over-votes will be 
recorded if this option is used and consequently not be shown in RCV 
reports. If this option is not selected, overvotes will be recorded for this 
contest when the algorithm reaches an overvoted ranking. 


Votes to include in threshold calculation: The user has the option 
between two variations of calculating the threshold value used to elect 
candidates: 


+ Continuing Ballots Per Round: Each round the total number of 
ballots assigned to candidates is calculated and used in the division that 
calculates the threshold. This means the threshold will lower as an 
increasing amount of ballots are exhausted in subsequent rounds, 


+ Continuing Ballots 1st round: Each round will re-use the total 
number of ballots assigned to candidates in the first round for each 
subsequent round. Therefore the threshold will remain the same 
throughout the tabulation. 


NOTE: If first round suspension option is used, the suspended ballots will not be 
included in the threshold calculation. 


+ Perform Elimination Transfer in Last round: The tabulation system 
will stop early if it detects that the number of continuing candidates is equal 
to the number of positions left to be elected plus one. For example, if the 
number of positions to elect is one, and if the system detects that only two 
candidates remain at the start of the round, the candidate with the least 
amount of votes is eliminated and the remaining candidate is elected 
without going into another round. This option allows the algorithm to 
perform the elimination transfer for the elimination transfer to the winning 
candidate if that winning candidate did not yet reach the threshold. Note: 
This option only applies the IRV or Points IRV methods. 


Assign Skipped Rankings to the set of Exhausted Ballots: This 
option allows the algorithm to assign Skipped Rankings to the set of 
Exhausted Ballots. If this option is not selected, any rankings that are left 
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Further, from the NYT Edison data displayed below, it is also clear from Series 358 
that with only 2 decimals showing in the Biden percentage of 0.45, the total fraction 
displayed cannot get anywhere near 100% regardless of any truncation in the 


Trump percentage. 


https://staticO1.nyt.com/elections-assets/2020/data/api/2020-11-03 /race- 





page/michigan/president.json 





Example: 


/data/races/0/timeseries/357/ 


v 357: 

¥ vote_shares: 
trumpd: 
bidenj: 

votes: 

eevp: 

eevp_source: 

timestamp: 
v 358: 

v vote_shares: 
trumpd: 
bidenj: 

votes: 

eevp: 
eevp_source: 
timestamp: 


0.534 

0.448 

3616879 

64 

"edison" 
"2020-11-047T06:58:472" 


®.533 

0.45 

3643075 

64 

"edison" 
"2020-11-04T07:00:37Z" 
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Hence, calculating the “points” for each candidate from the NYT Edison time series 
by multiplying the votes by the percentage to show the calculated votes/ (TV = 
Trump Votes) (BV = Biden Votes) 


state timestamp eevp trump biden TV BV 
michigan 2020-11-04T06:54:482Z 64 0.534 0.448 1925865.66 1615707.52 
michigan 2020-11-04T06:56:47Z 64 0.534 0.448 1930247.664 1619383.808 
michigan 2020-11-047T06:58:472 64 0.534 0.448 1931413.386 1620361.792 
michigan 2020-11-04T07:00:372Z 64 0.533 0.45 1941758.975 1639383.75 
michigan 2020-11-04T07:01:462Z 64 0.533 0.45 1945297.562 1642371.3 
michigan 2020-11-04T07:03:172Z 65 0.533 0.45 1948885.185 1645400.25 


3) The second piece of evidence that an algorithm is being utilized comes from our 
observation that the percentage of the votes submitted in each batch that went 
towards a candidate remain unchanged for a long series of time and for a number of 
consecutive batches is extremely concerning. Further, the percentage for Trump 
decreases in a mathematically extremely consistent pattern. The red arrows 
indicate the impossible consistencies. The statistical impossibility of the consistent 
percentage reported to Biden approaches zero. This makes clear an algorithm in the 
election system is allocating votes based on a percentage. 
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The top graph: 

The cumulative spread in percentage between Trump and Biden at any point in time 
during the vote counting is shown in this graph, where Trump is positive percentage. 

In other words, a point on the line in this graph represents which candidate is in the lead 
at any point in time, and by how much. Movement of the line in this graph indicates 
change in the magnitude a candidate is winning by. If the line slopes up, the votes are 
moving in a direction that favors Trump. If the line slopes down, the votes are moving in 
a direction that favors Biden. 


Case 2:20-cv-13134-LVP-RSW ECF No. 49-3, PagelD.3117 Filed 12/03/20 Page 7 of 32 


The middle graph: 

The total accumulated votes counted at any point in time for each candidate 1s 
represented in this graph. Red is Trump. Blue is Biden. 

The lower graph: 

Each bar on this graph represents what percentage of the votes submitted in each batch 
went towards a candidate, where Trump 1s positive and Biden is negative. 


Analysis: 

There are multiple highly anomalous features 1n this visualization of the Michigan, USA 
2020 General Election vote count data. It is important to understand the context of the 
lower graph and analysis. Every batch of vote counts released represents various groups 
of people and their votes. These groups of people’s votes are expected to have variance, 
even if multiple batches were produced out of the same geographic area. Large numbers 
of votes between multiple candidates are unlikely to have the same percentage of going 
towards a candidate multiple times in different batches. 

What we see in the lower graph instead of the expected variance in percentage of votes 
going to Trump or Biden in each batch are easily distinguishable trends, which are 
realistically improbable. The statistical probability of that pattern occurring throughout 
the graph approaches zero. 

The observation of these trends not only strongly suggests fraud, but also suggests 
automated and algorithmic tampering of vote counts. 


There is a mechanical correlation between the suspected algorithmically generated vote 
count releases (labeled in blue on the bottom graph) and the relative difference between 
the line in the upper graph and zero (an intersection with the line at y=0 1n the upper 
graph indicates a change in which candidate is leading). Furthermore, as soon as the line 
in the upper graph intersects with y=0, the algorithmically generated vote count releases 
switch to the opposing side - possibly to either maintain or eek in a Biden victory. 

Once the majority of apparent real and organic votes ceased to be counted, we are 
left with large swaths of released vote counts that repeatedly have the same exact 
percentage of votes in each release going to Biden. By exact, I mean exact. That is 
until stray batches of apparent organic votes are released, and then the percentage 
of votes in each release from the apparent algorithmically generated vote counts 
going to Biden seem to adjust slightly to account for the change, which then 
continue to repeat in each release, until the next stray organic batch, and the cycle 
repeats. It is difficult to come up with a realistic scenario where this described 
phenomenon is not the result of an algorithm behind the scenes. 


4) The suggestion that the information included in the “Spike Chart” of my original 
affidavit could be simply tabulated votes that were suddenly all reported is 
erroneous. The spike data came from Edison Research data and Oakland, the largest 
spike, was for November 7*, well past any “pent up” tabulated vote batches. Later 
data we found direct from Dominion to the NYT that did not pass through Edison 
confirms this and even adds further granularity. 


5) That there are problems in the Dominion System is clear from a visit our team 
made to Central Lake Township in Antrim Michigan on behalf of a local lawsuit filed 
by Michigan attorney Robert Marsh. Below is the field report submitted to me by 
our team. 
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ASOG Forensics Report on Central Lake Township in Antrim Michigan 


Report Date 11/29/2020 
Report Version 1.4 


On 11/27/2020 the ASOG forensics team visited Central Lake Township in 
Antrim Michigan on behalf of a local lawsuit filed by Michigan attorney Robert 
Marsh. 


The clerk of Central Lake Township — at around 10:30am — Ms. Judith L. 
Kosloski, presented to us “two separate paper totals tape” from Tabulator ID 2. 


One dated “Poll Opened Nov. 03/2020 06:38:48" (Roll 1) 
Another dated “Poll Opened Nov. 06/2020 09:21:58" (Roll 2) 


We were then told by her that on November 5, 2020, Ms. Kosloski was notified 
by Connie Wing of the County Clerk’s Office and asked to bring the tabulator and 
ballots to the County Clerk’s office for re-tabulation. They ran the ballots and 
printed “Roll 2”. She noticed a difference in the votes and brought it up to the 
clerk, but canvasing still occurred, and her objections were not addressed. 


Our team analyzed both rolls and compared the results. 


Roll 1 had 1,494 total votes 
Roll 2 had 1,491 votes (Roll 2 had 3 less ballots because 3 ballots were 
damaged in the process. ) 


“Statement of Votes Cast from Antrim” shows that only 1,491 votes were 
counted, and the 3 ballots that were damaged were not entered into final results. 


Ms. Kosloski stated that she and her assistant manually refilled out the three 
ballots, curing them, and ran them through the ballot counting system - but the 
final numbers do not reflect the inclusion of those 3 damaged ballots. 


http://www.antrimcounty.org/downloads/official results 2nd amended.pdf 
Source: http://www.antrimcounty.org/elections.asp 








In comparing the numbers on both rolls, we estimate 1,474 votes changed 
across the two rolls, between the first and the second time the exact same ballots 
were run through the County Clerk’s vote counting machine - which is almost the 
same number of voters that voted in total. 


The five most significant changes in vote totals are in the screenshots below: 
¢ On Election night, Trump received 566 votes, Biden received 340. On 


the recount, Trump had 1 less vote at 565 while Biden was unchanged 
at 340. This is particularly odd since 3 votes less were tabulated. So 
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potentially Trump could have lost between 3 and 4 votes overall on a 
very small sample — but that did not happen. 





















President and Vice 

President of the 

United States (1) 
Joseph R. Biden / Kamala 
D. Harris (Democrat): 





President and Vice 
President of the 
United States (1) 


Joseph R. Biden / Kamala 


. Harris (Democrat): 340 rr 

D. arr ais Donald J. Trump / Michael 

Donald J. Trump / Michael R. Pence (Republican): 
. Pence (Republican): 565 ' 

R. Pence (nepubl ical Jo Jorgensen / Jeremy 


Jo Joyaensen / Jeremy Cohen (Libertarian): 


Cohen (Libertarian): 8 
Don Blankenship / William 


Don Blankenship / William Mohy (U.S. Taxpayers): 


Mohy (U.S. Taxpayers): l a 
Howie Hawkins / Angela 

Howie Hawkins / Angela Walker (Green): 

Walker (Green): 2 


Rocky De La Fuente / Darcy — 
Rocky De La Fuente / Darcs Richardson (Natural Law): 






Richardson (Natural Law): 0 ORE 


Write-in: 





Write=in: 





Total Votes: 


Total Votes: 


Recount 11/6 Election 11/3 


¢ A Proposed Initiated Ordinance to Authorize One (1) Marihuana (sic) 
Retailer Establishment Within the Village of Central Lake (1). — On 
election night, it was a tie vote. Then, on the recount, when 3 ballots 
were not counted, the proposal passed with 1 vote being removed from 
the No vote. 
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Total Votes: 


Recount 11/6 Election 11/3 


¢ For the School Board Member for Central Lake Schools (3) there were 
742 votes added to this vote total. Since multiple people were elected, 
this did not change the result of both candidates being elected, but you 
do see a change in who had more votes. If it were a single person 
election, this would have changed the outcome, but this goes to the fact 
that votes can be and were changed during the second machine 
counting. 


RE 21M ——— 
Schoo! Board Member schoo! Board Member 
for Central Lake For Central Lake 
Schools (3) | Schools (3) 


Melanie Ecitar dts oc 
Keith Shafer: 


Helanie Eckhardt: 
Keith Shafer: 
Wr ite-in; Wy ite-in: 


Total Votes mom Total Votes: 


Recount 11/6 Election 11/3 


¢ For the School Board Member for Ellsworth Schools (2) it shows 657 
votes being removed from this election. In this case, only 3 people who 
were eligible to vote actually voted. Since there were 2 votes allowed for 
each voter to cast, the recount is correct to have 6 votes. But on 
election night, there is a major calculation issue: 
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Schoo! Board Member Schoo! Board Member 


for Ellsworth for E| |sworthn 
Schools (2) Schools (2) 


Christopher Wal lace: | 320. 
peiens | 


Recount 11/6 Election 11/3 





¢ In State Proposal 20-1 (1), there is a major change in votes in this 
category. 


Proposal 1 is a fairly technical and complicated proposed amendment to 
the Michigan Constitution to change the disposition and allowable uses 
of future revenue generated from oil and gas bonuses, rentals and 
royalties from state-owned land. There were 7/74 votes for YES during 
the election, to 1,083 votes for YES on the recount. 


Information about the proposal: https://crcmich.org/publications/statewide- 
ballot-proposal-20-1-michigan-natural-resources-trust-fund 
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Total Votes: 
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Total Votes; 


State Proposal 20-2 


Recount 11/6 Election 11/3 





Process 


Our team interviewed Ms. Kosloski on the process of tabulation and how the 
system works. 


Essentially, the Township Clerk is given two Compact Flash Cards and a 
Security Key. One CF card (also known as ISD Card) goes into the 
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“ADMINISTRATOR® in the “CF CARD 2” Slot and the other in the “POLL 
WORKER’ in the “CF CARD 1° Slot. The security key is used on the 
“SECURITY KEY” connector on top. 


Pre-election, Ms. Kosloski was given the cards by the County Clerk’s office. The 
County Clerk is Sheryl Guy. 


Once the printed ballots are hand-marked by voters, they are run through the 
machine. At the close of the polls, they run the totals on the print and bring the 
two CF Cards and security key back to the County Clerk for loading into the 
server. The cards and keys are not given back to the Township Clerk — these 
essential technical data sources for the Townships are thereafter held by the 
County Clerk. 


On November 6", at the request of the County Clerk, and with no explanation, 
Ms. Kosloski was told to bring the tabulator serial number AAFAJHX0226 and 
sealed ballots to the Country Clerk’s office. There, she was presented with two 
CF Cards and a security key. Then, they re-ran the original election day ballots. 
During this process, 3 ballots were damaged and not tabulated on the “Roll 2° 
results. Again, under the oversight of the canvassing board, Ms. Kowloski cured 
those ballots, and re-ran them, but they appear to have not been counted in the 
final vote totals. 


Conclusion 


The ASOG forensics team believes that a software change loaded into Tabulator 
ID 2 on November 6th did occur, and this caused the vote totals to change. The 
change happened on the Tabulator unit, but did so using software configurations 
from the Country Clerk. The Clear Lake Township Clerk Ms. Kosloski has never 
been told why they needed to re-tabulate the ballots. 


The forensics team would like access to the CF Cards and Security Key for Roll 
1 and the CF Cards and Security Key for Roll 2. We also request unrestricted 
access to the machine that programs the CF Cards, which we believe is called 
the “Election Event Designer” software of Dominion Democracy Suite — or like- 
software that was used to program these CF Cards. 


We do not believe that the Secretary of State report addresses this, and states 
the issue at the time was not on the printed totals tape. The Secretary even 
states “Because the Clerk correctly updated the media drives for the tabulators 
with changes to races, and because the other tabulators did not have changes to 
races, all tabulators counted ballots correctly.” This is not the case. 


We believe this directly contradicts the Sectary of State fact check document. 
(Link below.) 


November 7, 2020 Isolated User Error in Antrim County Does Not Affect Election 
Results, Has no Impact on Other Counties or States - Jocelyn Benson — 
secretary of State of Michigan 
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https://www.michigan.gov/documents/sos/Antrim Fact Check 707197 /.pdf 





Excerpt from document: 

“These errors can always be identified and corrected because every tabulator 
prints a paper totals tape showing how the ballots for each race were counted. 
After discovering the error in reporting the unofficial results, the clerk worked 
diligently to report correct unofficial results by reviewing the printed totals tape on 
each tabulator and hand-entering the results for each race, for each precinct in 
the county. Again, all ballots were properly tabulated. The user error affected 
only how the results from the tabulators communicated with the election 
management system for unofficial reporting. 


Even if the error had not been noticed and quickly fixed, it would have been 
caught and identified during the county canvass when printed totals tapes are 
reviewed. This was an isolated error, there is no evidence this user error 
occurred elsewhere in the state, and if it did it would be caught during county 
canvasses, which are conducted by bipartisan boards of county canvassers.” 


Summary 


lf this had been a user setup issue, then the test ballots they run to verify the 
results they get by comparing them with the test matrix should have caught that. 
When they made the software change that that used to tabulate the 11/6/20 re- 
run, there should be a log of the test ballots run through the system and verified 
against the test matrix. This alone might not show fraud, but it is a crucial part of 
the software configuration validation process and apparently was not done. 


We believe to a reasonable degree of professional certainty that this shows fraud 
and that vote changing at the local tabulator level has occurred due to a software 
change in all precincts were Dominion software was used in Michigan. This small 
sample amplified in a large population area would have major results. Without 
the explanation of why there was a re-tabulation, why the issue of numbers being 
off to a significant degree when a vote change was noted, and no further 
investigation occurred — and when 3 ballots were removed from the totals that 
changed the final outcome of one proposal, constitutes a definitive indication of 
fraud. 


6) Finally, Dr. Rodden was correct in his noting of excessive turnout figures listed in 
my affidavit for some precincts in MI based on new data from Michigan. The source 
of that original data was State level data that no longer exists or some unexplained 
reason. It existed at 

https://data.michigan.gov/ 

https: //mielections.us/election/results/2020GEN CENR.html] 








Currently, new data published by the various counties does change. However, at 
this point we see the current State of Michigan published data as follows: 
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County Precinct Turnout 
Ottawa Spring Lake Township, Precinct 6 - B 120.00% 
City of South Haven, Ward 3, Precinct 2 (Van Buren 
Allegan County) 100.00% 
Alger Grand Island Town Prec 1 96.77% 
Ottawa Tallmadge Charter Township, Precinct 3 - C 95.24% 
Macomb GROSSE POINTE SHORES-3 94.00% 
Oakland Fenton, Precinct 2 93.33% 
Ottawa Zeeland Charter Township, Precinct 4 - D 90.59% 
Muskegon Ravenna Township Precinct 1 89./2% 
Barry Thornapple Township, Precinct 1 89.23% 
Oakland Novi Township, Precinct 1 89.13% 
Kent Byron Township Precinct 4 89.08% 
Ottawa Jamestown Charter Township, Precinct 2 88.88% 
Barry Thornapple Township, Precinct 2 88.88% 
Oakland Lyon Township, Precinct 8 88.78% 
Livingston Oceola Township, Precinct 5 88.53% 
Ottawa Holland Charter Township, Precinct 4 - B 88.28% 
Oakland Lake Angelus, Precinct 1 88.21% 
Ottawa Port Sheldon Township, Precinct 1-A 88.19% 
Grand Blanc Township, 

Genesee Precinct 10 87.96% 
Ottawa Blendon Township, Precinct 2 - B 87.91% 
Kent Vergennes Township Precinct 1 87./5% 
Washtenaw York Township, Precinct 2 87.69% 
Oakland Oakland Township, Precinct 3 87.68% 
Livingston City of Brighton, Precinct 4 87.60% 
Sanilac Flynn Township, Precinct 1 87.37% 
Ottawa Blendon Township, Precinct 1 - B 87.04% 
Oakland Southfield Township, Precinct 4 87.03% 
Oakland Huntington Woods, Precinct 3 87.00% 
Washtenaw York Township, Precinct 3 86.97% 
Sanilac Delaware Township, Precinct 1 86.95% 
Sanilac Wheatland Township, Precinct 1 86.90% 
Washtenaw City of Dexter, Precinct 2 86.84% 
Kent Cascade Charter Township Precinct 8 86.83% 
Oakland Lyon Township, Precinct 6 86.81% 
Oakland Southfield Township, Precinct 3 86.79% 


The data shows 469 precincts with voter turn-out above 80%, according to current 
Michigan county records. Normalizing the current public data votes to 80% turnout 
(still 15%+/- above normal), the excess votes are at least 27,599 over the maximum 
that could be expected. 
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Declaration of NAME {redacted}. 
Pursuant to 28 U.S.C Section 1746, I, {redacted}, make the following declaration. 


1. Iam over the age of 21 years and I am under no legal disability, which would prevent me from giving this 
declaration. 

2. I was an electronic intelligence analyst under 305" Military Intelligence with experience gathering SAM 
missile system electronic intelligence. I have extensive experience as a white hat hacker used by some of the 
top election specialists in the world. The methodologies I have employed represent industry standard cyber 
operation toolkits for digital forensics and OSINT, which are commonly used to certify connections 
between servers, network nodes and other digital properties and probe to network system vulnerabilities. 

3. Tama US citizen and I reside at {redacted} location in the United States of America. 

4. The following link analysis was gathered through open source methodologies and are easily verifiable. 

5. As Dominion and Smartmatic makes claims that they are not connected in any way, not only are they 
connected but their business registration was 1n the same building on a foreign island to obfuscate their 


business dealings. 
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https://offshoreleaks.icij.org/nodes/101732449 


DOMINION VOTING SYSTEMS INTERNATIONAL CORPORATION 00 





Connected to ? addresses Data from: Paradise Papers - Barbados corporate registry 
Connected to 3 officers Barbados corporate registry data is current through 2016 


ope e 
id 

3 

; 

G 


8 Incorporated: 06-OCT-2009 @ 
@ Registered in: Barbados 
9 = Linked countries: Barbados 


Gota tip? Help ICU investigate: contact us or leak to us securely 











OFFSHORE LEAKS DATABASE 







ee THE GROVE, 21 PINE ROAD, 
BELLEVILLE, 8T MICHAEL, BB11113, 
BARBADOS. 








#1 RENDEZVOUS ROAD, WORTHING, 
; | CHRIST CHURCH, BARBADOS, BB1=006. 








a 
*%, & 
ts 2 
* a 
: 5h 
%G, é 
MACVICAR LAN A. 
of 
gees 
DOMINION VOTING SYSTEMS 
a EN es ee CORPORATION 
Sas cir ar 





Category 
@ Officer 
@ Address 
@ Entity 
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https://offshoreleaks.icij.org/nodes/101724285 
SMARTMATIC INTERNATIONAL CORPORATION 0 oO 


Connected to 1 address @ Data from: Paradise Papers - Barbados corporate registry 
Connected to 13 officers @ Barbados corporate registry data is current through 2016 
5 e Q Search in opencorporates 
Connected to 1 intermediary : mite | 
&] Gotatip? Help ICV investigate: contact us or leak to us securely 





£2 Incorporated: 29-SEP-2004 @ 
@ Registered in: Barbados 
9 = Linked countries: Barbados 








OFFSHORE LEAKS DATABASE 





I declare under penalty of perjury that the forgoing is true and correct to the best of my knowledge. Executed 
this November 23", 2020. 
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Smartmatic SSL Certificate 


Declaration of NAME {redacted}. 
Pursuant to 28 U.S.C Section 1746, I, {redacted}, make the following declaration. 


1. Iam over the age of 21 years and I am under no legal disability, which would prevent me from giving this 
declaration. 

2. I was an electronic intelligence analyst under 305" Military Intelligence with experience gathering SAM 
missile system electronic intelligence. I have extensive experience as a white hat hacker used by some of the 
top election specialists in the world. The methodologies I have employed represent industry standard cyber 
operation toolkits for digital forensics and OSINT, which are commonly used to certify connections 
between servers, network nodes and other digital properties and probe to network system vulnerabilities. 

3. Tama US citizen and I reside at {redacted} location in the United States of America. 

4. Researching Smartmatic’s website and reading their public manuals about the reuse of SSL certificate’s, I 
started to investigate Smartmatic’s SSL certificates. Upon searching their website is currently behind 
Cloudflare yet using the same SSL certificate it made it easy to locate where Smartmatic’s website was 
located. Smartmatic’s website 1s in the Philippine’s on their Election commission’s server 


(Comelec.gov.ph). 


{ €)> C @/0|\@r tips://censys.io/domain:q=smartmaticcom 





Quick Filters Websites 

For all fields, see Data Definitions Page: 1/1 Results: 7 Time: 18ms 

Protocol: #@ comelec.gov.ph (172.67.165.108) 
1 25/smip 117,344 295/smtp 

Tag: 


1 smip 
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os | | 
® 7 ¢ @ | 7) | i hitps://censys.io/domain/comelec.gov.ph 
em ¢ = | 
a> Censys eRe = comelec.gov.ph 


comelec.gov.ph 
#@ Summary 


Basic Information 
Alexa Rank 117,344 
Protocols 25/SMTP 


rags €D 









443 /HTTPS 

| QoetaLs | DETAILS GO 
25/SMTP 
Banner Grab and StartTLS Initiation 


Banner 220 sulat.comelec.gov.ph ESMTP ready. 


EHLO 250:sulat.comelec.gov.ph Hello worker-04.sfj.censys-scanner.com [192.35.1 68.64] 
Zo0-SIZE 524276800 
250-8BITMIME 
290-PIPELINING 
200-STARTTLS 
290 HELP 





ey 
(<) ac; «ia | | @ hittps://censys.io/domain/comelec.gov.ph 


due Ce nsys eR Crise § comelec.gov.ph 


at ark 2 oo bet pa ae Phe pk a he 


TLS Handshake 
Version TLSv1.2 
Cipher Suite TLS_RSA_WITH_AES_128_CBC_SHA (@x@@2F) 


Certificate Chain 


ea6?717e8b946ce5d847dc3067767 eaf91340340274c185978as 7a3T58691c68fe 
C=ph, L=Manila, O=Comelec, CN=cntfw02 
C=ph, L=Manila, O=Comelec, CN=Comelec WebAdmin CA, emailAddress=jesus.suarez@smartmatic.com 
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~~. , 
(<) > C | © | @ hitps://censys.io/certificates/ea62 1 7e8b940ce5d847dc3067767eaf9 134034024c185978a7 7a3f5869 1 c68fe 


Hl Orlt moo Mea = 





te Censys 


cntfw02 


# Certificate~ £& 


Basic Information 
Subject DN 
Issuer DN 


Serial 


Validity 
Names 

Fingerprint 
SHA-256 


SHA-1 
MD5 


Public Key 


Key Type 
Modulus 





PEM 


C=ph, L=Manila, O=Comelec, CN=cntfw02 


C=ph, L=Manila, O=Comelec, CN=Comelec WebAdmin CA, 
emailAddress=jesus.suarez@smartmatic.com 


Decimal: 12281028647573638623 
Hex: @xaabefa7cbfO@5cddf 


2016-04-09 12:33:00 to 2038-01-01 00:00:01 (7936 days, 11:27:01) 
cntfw02 


ea6217e8b948ce5d847dc3867767eaf9134034024c185978a77a3F58691c68fe 
60df fa9506646ee1 960426659a4c68b1 fa2a72F5 
ced388f1476a851937cb1 f8b8bd3d12a 


2048-bit RSA, e = 65,537 


d9 :8e:aa:86 :b@:6c:91:7b:09 :5d:65:10:e6 :bd:38:8f :c4:5e:16:1d: 


Q Certificates + e€a6217e8b940ce5d847dc3067767eaf9134034024c185978a77a3f58691c68fe 


A 


Expand 


G& RawData~ Q Explore ~ 
Browser Trust 


Apple A Untrusted 
Microsoft A Untrusted 
MozillaNSS A Untrusted 


Key Usage and Constraints 


Key Usage Content Commitment, Digital 
Signature, Key Encipherment 


Censys Metadata 


Updated At 2018-09-01 21:55:09 
Source Scan 


Tags unknown, untrusted, unexpired 





¥v 








€) > C 0 | @ hittps://censys.io/certificates/ea62 17e8b940ce5d847dc3067767 eaf9 134034024c185978a7 7a3158691 c68fe 


Al-Ur\|t nO o Me pa = 





ft 
4. Censys 
SPKI SHA-256 


Signature 
Algorithm 
Signature 


Extensions 
Auth Key ID 
Subject Key ID 
Key Usage 
Constraints 


SANs 


Q Certificates + ea6217e8b940ce5d847dc3067767eaf9134034024c185978a77a3f58691c68fe 


4039e3117b53c6736957eab9ce578e88bebf 1 9b5c f5d6d5228187ac44d1e064f 


SHA256-RSA (1 .2.848.113549.1.1.11) 
48:29:0a:64:fb:21:2c:b9:05:98:8c:f3:94:9d:f8:3a:7f :9e:cO8:fa: 


3908b6e1 f2c747e4e55fd65f27d31a77d31640c8 [parents] [siblings] 
81e2a597580341 e@c3e@bb2fa2d46b5e38c9c8d72d [children] 

Content Commitment, Digital Signature, Key Encipherment 

Is CA: False 


@ cntfwo02 


Expand 


A 


5. Ascan be seen in the images above the SSL certificate used was registered by the email address 
jesus.suarez@smartmatic.com on the 9" of April 2016. 
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(<) > C A | 0) | @ https://censys.io/domain/comelec.gov.ph/table#25 


(<)> ¢ 





Hl-UOr + moo Mea = 








comelec.gov.ph 


te Censys 


@ Summary 


Attribute 
25.smtp.starttils.banner 


25.smtp.starttls.ehlo 


25.smtp.starttls.starttls 
25.smtp.starttis.tis.certificate.parsed.extensions.authority_key_id 


25.smtp.starttis.tis.certificate.parsed.extensions.basic_constraints.is_ca 


25.smtp.starttis.tis.certificate.parsed.extensions.key_usage.content_commitment 
25.smtp.starttis.tis.certificate.parsed.extensions.key_usage.digital_signature 


25.smtp.starttls.tis.certificate.parsed.extensions.key_usage.key_encipherment 


25.smtp.starttis.tis.certificate.parsed.extensions.key_usage.value 


25.smtp.starttis.tis.certificate.parsed.extensions.subject_alt_name.dns_names 


25.smtp.starttls.tls.certificate.parsed.extensions.subject_key_id 
25.smtp.starttis.tis.certificate.parsed.fingerprint_md5 


Expand 


f Raw Data~ 


Value 
220 sulat.comelec.gov.ph ESMTP ready. 


250-sulat.comelec.gov.ph Hello worker-04.sfj.censys-scanner.com [192.35.168.64] 
250-SIZE 52428800 

250-8BITMIME 

250-PIPELINING 

250-STARTTLS 

250 HELP 


220 TLS go ahead 

3908b6e1 f2c747e4e55fd65f27d31a77d31640c0 
False 

True 

True 

True 

7 

cntfw02 
81e2a59750341e0c3e0bb2fa2d46b5e30c9c0d2d 





ced388f1476a851937cb1 f8b8bd3d12a 





@ | 0) | ra https://censys.io/domain/comelec.gov.ph/table#25 


Hl Orlt moo Mea = 





25.smtp.starttis.tis.certificate.parsed.fingerprint_sha1 


“te Censys 


25.smtp.starttls.tls.certificate. parsed. fingerprint_sha256 
25.smtp.starttis.tis.certificate.parsed.issuer.common_name 
25.smtp.starttls.tis.certificate.parsed.issuer.country 
25.smtp.starttls.tls.certificate.parsed.issuer.email_address 
25.smtp.starttls.tis.certificate.parsed.issuer.locality 
25.smtp.starttls.tis.certificate.parsed.issuer.organization 
25.smtp.starttls.tis.certificate.parsed.issuer_dn 
25.smtp.starttls.tis.certificate.parsed.names 
25.smtp.starttls.tis.certificate.parsed.redacted 
25.smtp.starttls.tls.certificate.parsed.serial_number 
25.smtp.starttls.tis.certificate.parsed.signature.self_signed 
25.smtp.starttls. tls.certificate.parsed.signature.signature_algorithm.name 
25.smtp.starttls.tls.certificate.parsed.signature.signature_algorithm.oid 
25.smtp.starttls.tis.certificate.parsed.signature.valid 


25.smtp.starttls.tis.certificate.parsed.signature.value 


Expand 


60dffa9506646ee1960426659a4c68b1fa2a72F5 
€a6217e8b940ce5d847dc3067767eaf9134034024c1 85978a77a3f58691c68fe 
Comelec WebAdmin CA 

ph 

jesus.suarez@smartmatic.com 

Manila 

Comelec 

C=ph, L=Manila, O0=Comelec, CN=Comelec WebAdmin CA, emailAddress=jesus.suarez@smartmatic.com 
cntfw02 

False 

12281028647573638623 

False 

SHA256WithRSA 

1.2.840.113549.1.1.11 

False 


SCkKZPshLLkFkizzlJ3wOn+ewPoSWCODv1IGHU2EdD5fZKQ7X+ideWa8rl6h6u6jTxs2/6rN5bE5qJ5cTiLnd 
Gr8w4shgXTzoJyFpbnQ+nhod8KRnoKdHCGeg9ucL JkOsp8i 

/RgPl/ JP4HN8N5v6f7r682r8ISdN5CuTalMLJa9 TuyebDUWeGX3GhWARdgOQIDYh8dV/4E/bp7+Vt+loS 
/qviOXZR6DB4wSV/2ErEtJIGnISaMDEhcAk 
/NsQa2k9NPj8E4prRbJiEAMYwedjiGoR5rQxLtvdpliOmnuF2JDgLuf7qulyPHGFLadJ3i1d 
/QqwWuHiQtLxvHVQQUwvxhw== 
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Hl-UOr + moo Mea = 


comelec.gov.ph Expand €) 


SHA256WithRSA 


(<) > Co | 0) | @ hittps://censys.io/domain/comelec.gov.ph/table#25 








14 Censys 


25.smtp.starttis.tls.certificate.parsed.signature_algorithm.name 
25.smtp.starttis.tis.certificate.parsed.signature_algorithm.oid 


25.smtp.starttis.tis.certificate.parsed.spki_subject_fingerprint 


1.2.840.113549.1.1.11 
0d8951ea3bd17cb530a077c61ba8d761cae184b46d9c187d886613e669fabec7 


25.smtp.starttls.tis.certificate.parsed.subject.common_name cntfw02 
25.smtp.starttis.tis.certificate.parsed.subject.country ph 
25.smtp.starttls.tls.certificate.parsed.subject.locality Manila 
25.smtp.starttls.tis.certificate.parsed.subject.organization Comelec 


25.smtp.starttls.tis.certificate.parsed.subject_dn C=ph, L=Manila, O=Comelec, CN=cntfw02 


25.smtp.starttis.tls.certificate.parsed.subject_key_info.fingerprint_sha256 4039e3117b53c6736957eab9ce578e88bObfl 9bS5cf5d6d5228107ac44d1 e064f 


25.smtp.starttis.tis.certificate.parsed.subject_key_info.key_algorithm.name RSA 
25.smtp.starttis.tis.certificate.parsed.subject_key_info.rsa_public_key.exponent 65537 
25.smtp.starttls.tis.certificate.parsed.subject_key_info.rsa_public_key.length 2048 


2Y6qhrBskXsJXWUQ5r04j8ReFh1 OIL5S48KrTelKr9F6H5HCJ7204/HV9D6Wx9ToldoKOCxn019YbOMQ7rw 
GKiZot5+VCHJ6QbDKVPIMDPdFJ36XcQy20AB9zt3A9yuREBWwuBuW 1 ctkVNKH+Jgau+tH 1 amO8ncaCFaZ 
FxYWCryIT TrkVke/X4uX6uzT+4sNN9rso 

/OMIAyebVyG2zsk1 DBfOQYu6ACE7LLjO6RXidMx5KUpXZGqykUISgESOIjRWFcpnv8wWodn6FfoETXZ1YO 
wJbPeV0zJd3TffiwJCEcC7oyD4AyEVEVyAXgehOz44AEs3bcRuMdiejKzk4tG97uw== 


25.smtp.starttis.tis.certificate.parsed.subject_key_info.rsa_public_key.modulus 


25.smtp.starttis.tis.certificate.parsed.tbs_fingerprint ea91132986addf5da6e2c00954b27eaf6da981e1 7d39e7 4b4c8cf4aa6c673e44 


25.smtp.starttis.tis.certificate.parsed.tbs_noct_fingerprint e€a91132986addf5da6e2c00954b27eaf6da981e1 7d39e7 4b4c8cf4aa6c673e44 


25.smtp.starttls.tis.certificate.parsed.validation_level unknown 





25.smtp.starttls.tls.certificate.parsed.validity.end 2038-01-01T00:00:01Z 





(<) > Cc 0 | @ hittps://censys.io/domain/comelec.gov.ph/table#25 EF) | oe Y ty | + Iii 0 @ qa ®* @ = 


fy --.-» — @ 





i Censys 


25.smtp.starttls.tls. certificate. parsed.validity.length 685711621 
25.smtp.starttls.tls.certificate.parsed.validity.start 2016-04-09T12:33:00Z 
25.smtp.starttls.tls. certificate. parsed.version 3 
25.smtp.starttls.tls.cipher_suite.id 0x002F 


25.smtp.starttls.tis.cipher_suite.name TLS_RSA_WITH_AES_128_CBC_SHA 
25.smtp.starttls.tis.ocsp_stapling False 


25.smtp.starttls.tis.validation.browser_error x509: certificate signed by unknown authority 


25.smtp.starttls.tis.validation.browser_trusted False 
25.smtp.starttls.tls.version TLSv1.2 
443.https.dhe.support False 
443.https.dhe_export.support False 
443.https.rsa_export.support False 

alexa_rank 117344 

domain comelec.gov.ph 
ports 25 

protocols 25/smtp 

tags smtp 


updated_at 


2020-1 1-30T12:20:01+00:00 
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Suarez Méndez 








F ty 


Jesus Alberto Suarez Méndez veo VISEO IBERIA 
Senior Consultant at VISEO IBERIA 


Alcorcén, Community of Madrid, Spain - 500+ connections 





Universidad de los Andes (VE) 


& Blog# 


Join to Connect 





About 


DevOps SysAdmin and Information Security Professional with more than 20 years of experience. 
Specialized in Security and IT Management, IT Risk Assessment and Management, IT architecture, 
automatized deployments on Linux environment and cloud using DevOps tools. Very interested in 


OOOO 
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{ €_i- ¢@ it | 2 hitps://es.linkedin.com,in/jesusalbertosuarez 


* . 
L in ked in People ¥ Jesus Alberto Suarez Méndez 


Master Information Security Specialist 
Smartmatic 


Aug 2008 - Mar 2017 - 8 years 8 months 





Caracas, Venezuela 

Design, deployment, operation and support on security of network and infrastructure in 
Smartmatic projects. Provide Security Architecture based on Risk Assessment. Develop Business 
Continuity and Disaster Recovery Plan. Perform Vulnerability assessment, ethical hacking and 


penetration testing. Advisor on information security issues. 


yk Bancaribe 
vas years 11 months 


Security Specialist 

Aug 2003 - Aug 2008-5 years 1 month 

Caracas, Venezuela 

Planification and Management of Information Security System. Vulnerability and Risk 
Management. Leader of risk assessment and security evaluation team on Software Development 
Life Cicle projects. Advisor on information security issues and methodologies. Support on 
Incident Response Team. 


Information Security Administrator 
May 2001 - Aug 2003 - 2 years 4 months 
Caracas, Venezuela 
< 
6. As seen from Jesus’ LinkedIn profile, he was employed by Smartmatic as their Master Information Security Specialist 
from August 2008 — March 2017, within the time frame of the registered SSL certificate for Smartmatic and within 
Venezuela. 
7. This evidence shows that Smartmatic was indeed connected to Venezuela as well as shows that their dealings with 
the Philippine’s is still on-going as their website is in their election commission servers with matching and current 
SSL certificates. 


I declare under penalty of perjury that the forgoing is true and correct to the best of my knowledge. Executed 
this November 23", 2020. 
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Smartmatic SSL Certificate 


Declaration of ee 


Pursuant to 28 U.S.C Section 1746, I, MM, make the following declaration. 


l. 


I am over the age of 21 years and I am under no legal disability, which would prevent me from giving this 


declaration. 


. Iwas an electronic intelligence analyst under 305" Military Intelligence with experience gathering SAM 


missile system electronic intelligence. I have extensive experience as a white hat hacker used by some of the 
top election specialists in the world. The methodologies I have employed represent industry standard cyber 
operation toolkits for digital forensics and OSINT, which are commonly used to certify connections 


between servers, network nodes and other digital properties and probe to network system vulnerabilities. 


. Lama US citizen and I reside at PL location in the United States of America. 


Researching Smartmatic’s website and reading their public manuals about the reuse of SSL certificate’s, I 
started to investigate Smartmatic’s SSL certificates. Upon searching their website is currently behind 
Cloudflare yet using the same SSL certificate it made it easy to locate where Smartmatic’s website was 
located. Smartmatic’s website is in the Philippine’s on their Election commission’s server 


(Comelec.gov.ph), as seen below: 


| <— oe | © | @ https://censys.io/domain?q=smartmatic.com 





Q Websites + smartmatic.com 


By 
4... Censys 


Quick Filters Websites 

For all fields, see Data Definitions Page: 1/1 Results: 17 Time: 18ms 

Protocol: @ comelec.gov.ph (172.67.165.108) 
1 25/smip 117,344 20/smtp 

Tag: 
1 smtp 
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(<) > Cc | , | @ hitps://censys.io/domain/comelec.gov.ph 





“io Censys OM cm ms = Ccomelec.gov.ph 
comelec.gov.ph 
@ Summary 


Basic Information 
Alexa Rank 117,344 


Protocols 25/SMTP 


Tags ID 









443 /HTTPS 
| Qoetas | DETAILS GO 

25/SMTP 

Banner Grab and StartTLS Initiation 


Banner 220 sulat.comelec.gov.ph ESMTP ready. 


EHLO 250-sulat.comelec.gov.ph Hello worker-04.sfj.censys-scanner.com [192.35.168.64] 
2O0-SIZE 524276800 
290-8BITMIME 
290-PIPELINING 
200-STARTTLS 
200 HELP 
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on 
(<) = ae | | @ hitps://censys.io/domain/comelec.gov.ph 


aad age 
d.- Censys CWO NiCSee a comelec.gov.ph 


wart Pht Oe eS eee 


TLS Handshake 
Version TLSv1.2 


Cipher Suite TLS_RSA_WITH_AES_128_CBC_SHA (@x@82F) 


Certificate Chain 


ea6217e8b940ce5d847dc3067767 eaf9134034024c185978a77a3f58691cb68fe 
C=ph, L=Manila, O=Comelec, CN=cntfw02 
C=ph, L=Manila, O=Comelec, CN=Comelec WebAdmin CA, emailAddress=jesus.suarezi(@smartmatic.com 








(<) > Co 0 | Mi https://censys.io/certificates/ea6217e8b940ce5d847dc3067767 eaf9 134034024c185978a77a3'5869 1 c68fe a , wy | + i\ O @ Se ¢* @ = 
aA 
Hi 
aus Censys eMecniie-me— €a6217e8b940ce5d847dc3067767eaf9134034024c1 85978a77a3f58691 c68fe Expand 


cntfw02 


# Certificate~ 2% PEM & RawDataey Q Explore - 


Basic Information 


Browser Trust 
Subject DN C=ph, L=Manila, O=Comelec, CN=cntfw02 


Issuer DN C=ph, L=Manila, O0=Comelec, CN=Comelec WebAdmin CA, Apple: A unrated 


emailAddress=jesus.suarez@smartmatic.com Microsoft A Untrusted 


Serial Decimal: 12281028647573638623 MozillaNSS A Untrusted 
Hex: @xaabefa7cbf@5cddf 


Validity 2016-04-09 12:33:00 to 2038-01-01 00:00:01 (7936 days, 11:27:01) 


Names cntfw02 
Key Usage and Constraints 
Fingerprint Key Usage Content Commitment, Digital 
SHA-256 ¢a6217e8b940ce5d847dc3067767eaf9134034024c185978a77a3F58691c68fe a 
SHA-1 60dffa9506646ee1960426659a4c68b1 fa2a72F5 
MD5 ced388f1476a851937cb1f8b8bd3d12a 


Censys Metadata 
Public Key 
Updated At 2018-09-01 21:55:09 


K 2048-bit RSA, e = 65,537 
ey Type v STRONG ane ieee 


Modulus d9:8e:aa:86 :b@:6¢:91:7b:09 :5d:65:10:e6 :bd:38:8f:c4:5e:16:1d: a ee 
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(<) > C 0 | @ hitps://censys.io/certificates/ea62 17e8b940ce5d847dc3067767 eaf9 134034024c185978a7 7a3f5869 1 c68fe E) | oe Y wy + I\ 0 @ ea ® @ = 


A 
OMe sills § e€a6217e8b940ce5d847dc3067767eaf9134034024c185978a77a3f58691 c68fe Expand Gs) 


SPKI SHA-256 4639e3117b53c6736957eab9ce578e88bObf 1 9b5c f5d6d5228187ac44d1e864f 








0 Censys 


Signature 


Algorithm SHA256-RSA (1.2.848.113549.1.1.11) 
Signature 48:29:0a:64:fb:21:2c:b9 :05 :98:8c:f3 :94:9d:f0:3a:7f :9e:cO:fa: 


Extensions 


Auth Key ID 3908b6e1f2c747e4e55fd65f27d31a77d31640c8 [parents] [siblings] 
Subject Key ID 81¢2a59758341e@c3e@bb2fa2d46b5e30c9cd2d [children] 
Key Usage Content Commitment, Digital Signature, Key Encipherment 
Constraints |s CA: False 


SANs @ cnitfw02 


5. As can be seen in the images above the SSL certificate used was registered by the email address 
jesus.suarez@smartmatic.com on the 9" of April 2016. 








(<) > C | 0 | @ hittps://censys.io/domain/comelec.gov.ph/table#25 E) | UPR | + IX O @ oe © 8S 
A 
~ Cens Ss OM (sim §=COomelec.gov.ph Expand 
dye y = am P 
comelec.gov.ph 
# Summary f Raw Data~ 
Attribute Value 
25.smtp.starttls.banner 220 sulat.comelec.gov.ph ESMTP ready. 
25.smtp.starttis.ehlo 250-sulat.comelec.gov.ph Hello worker-04.sfj.censys-scanner.com [192.35.168.64] 
250-SIZE 52428800 
250-8BITMIME 
250-PIPELINING 
250-STARTTLS 
250 HELP 
25.smtp.starttls.starttls 220 TLS go ahead 
25.smtp.starttls.tls.certificate.parsed.extensions.authority_key_id 3908b6e1 f2c747e4e55fd65f27d31a77d31640c0 
25.smtp.starttis.tis.certificate.parsed.extensions.basic_constraints.is_ca False 


25.smtp.starttis.tis.certificate.parsed.extensions.key_usage.content_commitment True 





25.smtp.starttls.tis.certificate.parsed.extensions.key_usage.digital_signature True 

25.smtp.starttls.tis.certificate.parsed.extensions.key_usage.key_encipherment True 

25.smtp.starttis.tis.certificate.parsed.extensions.key_usage.value 7 

25.smtp.starttls.tis.certificate.parsed.extensions.subject_alt_name.dns_names cntfw02 

25.smtp.starttls.tls.certificate.parsed.extensions. subject_key_id 81e2a59750341e0c3e0bb2fa2d46b5e30c9c0d2d 

25.smtp.starttls.tls.certificate.parsed.fingerprint_md5 ced388f1476a851937cb1 f8b8bd3d12a 
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(€) => Cc @ | 0 | & https://censys.io/domain/comelec.gov.ph/table#25 


Hl-Onrlt noo Me @ = 








25.smtp.starttis.tis.certificate.parsed.fingerprint_sha1 
25.smtp.starttls.tis.certificate.parsed.fingerprint_sha256 


an Censys 


25.smtp.starttis.tis.certificate.parsed.issuer.common_name 
25.smtp.starttls.tis.certificate.parsed.issuer.country 
25.smtp.starttls.tls.certificate.parsed.issuer.email_address 
25.smtp.starttls.tis.certificate.parsed.issuer.locality 
25.smtp.starttls.tis.certificate.parsed.issuer.organization 
25.smtp.starttls.tis.certificate.parsed.issuer_dn 
25.smtp.starttls.tis.certificate.parsed.names 
25.smtp.starttls.tis.certificate.parsed.redacted 
25.smtp.starttls.tis.certificate.parsed.serial_number 
25.smtp.starttls.tis.certificate.parsed.signature.self_signed 
25.smtp.starttls.tls.certificate. parsed.signature. signature_algorithm.name 
25.smtp.starttls.tis.certificate.parsed.signature.signature_algorithm.oid 
25.smtp.starttls.tis.certificate.parsed.signature. valid 


25.smtp.starttis.tis.certificate.parsed.signature.value 


A 
Expand @ 


60dffa9506646ee1960426659a4c68b1fa2a72F5 
€a6217e8b940ce5d847dc3067767eaf9134034024c1 85978a77a3f58691c68fe 
Comelec WebAdmin CA 

ph 

jesus.suarez@smartmatic.com 

Manila 

Comelec 

C=ph, L=Manila, O=Comelec, CN=Comelec WebAdmin CA, emailAddress=jesus.suarez@smartmatic.com 
cntfwo2 

False 

12281028647573638623 

False 

SHA256WithRSA 

1.2.840.113549.1.1.11 

False 


SCkKZPshLLkFkizzlJ3wOn+ewPoSWCODv1IGHU2EdD 5fZKQ7X+IdeWa8rl6h6u6jTxs2/6rN5bE5qJ5cTiILnd 
Gr8w4shgXTzoJyFpbnQ+nhod8kKRnoKdHCGeg9ucL JkOsp8i 
/RgPI/JP4HN8N5v6f7r682r8ISdN5CuTalMLJa9 TuyebDUWeGX3GhWARdgOQIDYh8dV/4E/bp7+Vt+l0S 
/qviOXZR6DB4wSV/2ErEtJIGnISaMDEhcAk 
/NsQa2k9NPj8E4prRbJiEAMYwedjiGoR5rQxLtvdpliOmnuF2JDgLuf7qulyPHGFLadJ3i1d 
/qwWuHiQtLxvHVQQUwvxhw== 











Hl-UOr + mnoo Me a = 





(<) > oC! Ay | 10) | @ https://censys.io/domain/comelec.gov.ph/table#25 


25.smtp.starttls.tls.certificate.parsed.signature_algorithm.name 
25.smtp.starttls.tis.certificate.parsed.signature_algorithm.oid 
25.smtp.starttls.tis.certificate.parsed.spki_subject_fingerprint 
25.smtp.starttis.tis.certificate.parsed.subject.common_name 
25.smtp.starttls.tls.certificate.parsed.subject.country 
25.smtp.starttls.tls.certificate.parsed.subject.locality 
25.smtp.starttls.tls.certificate.parsed.subject.organization 
25.smtp.starttls.tls.certificate.parsed.subject_dn 
25.smtp.starttls.tis.certificate.parsed.subject_key_info.fingerprint_sha256 
25.smtp.starttls.tis.certificate.parsed.subject_key_info.key_algorithm.name 
25.smtp.starttls.tis.certificate.parsed.subject_key_info.rsa_public_key.exponent 
25.smtp.starttls.tis.certificate.parsed.subject_key_info.rsa_public_key.length 
25.smtp.starttls.tls.certificate.parsed.subject_key_info.rsa_public_key.modulus 


oe Censys 


25.smtp.starttls.tls.certificate.parsed.tbs_fingerprint 
25.smtp.starttls.tls.certificate.parsed.tbs_noct_fingerprint 
25.smtp.starttls.tls.certificate.parsed.validation_level 
25.smtp.starttls.tls.certificate.parsed.validity.end 


Expand C) 


SHA256WithRSA 

1.2.840.113549.1.1.11 

0d8951ea3bd17cb530a077c61 ba8d761cae1 84b46d9c187d886613e669fabec7 
cntfw02 

ph 

Manila 

Comelec 

C=ph, L=Manila, O=Comelec, CN=cntfw02 
4039e3117b53c6736957eab9ce578e88bObfl 9b5cf5d6d5228107ac44d1 e064f 
RSA 

65537 

2048 


2Y6qhrBskXsJXWUQ5r04j8ReFh1 OIL548KrTelKr9F6H5SHCJ7204/HV9D6WXx9ToldoKOCxn019YbOMQ7rw 
GKiZot5+VCHJ6QDKVPIMDPdFJ36XcQy20AB9zt3A9yuREBWwuBuW 1 ctk VNKH+Jgau+tH 1 amO8ncaCFaZ 
FxYWCrylIT TrkVke/X4uX6uzT+4sNN9rso 
/OMIAyebVyG2zsk1bBfOQYu6ACE7LLjO6RXidMx5KUpXZGaykUISgESOIjRWFcpnv8wWodn6FfoETXZ1YO 
wJbPeV0zJd3TffiwJCEcC7oyD4AyEVEVyAXgehOz44AEs3bcRuMdiejKzk4tG97uw== 


ea91132986addf5da6e2c00954b27eaf6da981e1 7d39e74b4c8cf4aab6c673e44 
ea91132986addf5da6e2c00954b27eaf6da981el 7d39e7 4b4c8cf4aa6c673e44 
unknown 


2038-01-01T00:00:012 
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(<) =7 2 oy Aj | VU | @ hitps://censys.io/domain/comelec.gov.ph/table#25 E) | -- OW | v il 2 2 eu e 8 = 
A 
. Censys comelec.gov.ph Expand @ 
25.smtp.starttls.tls.certificate.parsed.validity.length 685711621 
25.smtp.starttls.tls.certificate.parsed.validity.start 2016-04-09T12:33:00Z 
25.smtp.starttis.tis.certificate.parsed.version 3 
25.smtp.starttis.tis.cipher_suite.id 0x002F 
25.smtp.starttis.tis.cipher_suite.name TLS_RSA_WITH_AES_128_CBC_SHA 
25.smtp.starttls.tis.ocsp_stapling False 
25.smtp.starttis.tis.validation.browser_error x509: certificate signed by unknown authority 
25.smtp.starttis.tis.validation.browser_trusted False 
25.smtp.starttls.tls.version TLSv1.2 
443.https.dhe.support False 
443.https.dhe_export.support False 
443.https.rsa_export.support False 
alexa_rank 117344 
domain comelec.gov.ph 
ports 25 
protocols 25/smtp 
tags smtp 
updated_at 2020-1 1-30T12:20:01+00:00 
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Suarez Méndez 








F ty 


Jesus Alberto Suarez Méndez veo VISEO IBERIA 
Senior Consultant at VISEO IBERIA 


Alcorcén, Community of Madrid, Spain - 500+ connections 





Universidad de los Andes (VE) 


& Blog# 


Join to Connect 





About 


DevOps SysAdmin and Information Security Professional with more than 20 years of experience. 
Specialized in Security and IT Management, IT Risk Assessment and Management, IT architecture, 
automatized deployments on Linux environment and cloud using DevOps tools. Very interested in 


OOOO 
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= Cf | © | & https://es.linkedin.com/in/jesusalbertosuarez 


Ld 
L in ked in People ¥ Jesus Alberto Suarez Méndez 


Master Information Security Specialist 


Smartmatic 





Aug 2008 - Mar 2017 - 8 years 8 months 

Caracas, Venezuela 

Design, deployment, operation and support on security of network and infrastructure in 
Smartmatic projects. Provide Security Architecture based on Risk Assessment. Develop Business 
Continuity and Disaster Recovery Plan. Perform Vulnerability assessment, ethical hacking and 


penetration testing. Advisor on information security issues. 


zh Bancaribe 
Fas years 11 months 


Security Specialist 

Aug 2003 - Aug 2008-5 years 1 month 

Caracas, Venezuela 

Planification and Management of Information Security System. Vulnerability and Risk 
Management. Leader of risk assessment and security evaluation team on Software Development 
Life Cicle projects. Advisor on information security issues and methodologies. Support on 
Incident Response Team. 


Information Security Administrator 
May 2001 - Aug 2003 - 2 years 4 months 


Caracas, Venezuela 
< 


6. As seen from Jesus’ LinkedIn profile, he was employed by Smartmatic as their Master Information Security Specialist 
from August 2008 — March 2017, within the time frame of the registered SSL certificate for Smartmatic and within 
Venezuela. 

7. This evidence shows that Smartmatic was indeed connected to Venezuela as well as shows that their dealings with the 
Philippine’s 1s still on-going as their website is in their election commission servers with matching and current SSL 
certificates. 





I declare under penalty of perjury that the forgoing is true and correct to the best of my knowledge. Executed 
this December 3, 2020. 





